Invoice Fraud

Invoice fraud is when a stranger sends you a bill that looks real and asks you to pay it into a different bank account. It usually comes in the name of a supplier you already use, for an amount you were expecting, which is exactly why it works.

The email looks identical to the ones you have had for years because, in a sense, it is one of them. Someone has been quietly reading your supplier's mailbox for weeks, waiting for a genuine invoice to go out. He copies it, changes two lines of bank details and sends it again from an address that differs by one letter. That is why the logo, the layout, the signature and even the old typo in the footer all look right.

Sometimes there is no fake address at all, because the mailbox itself is under his control. The message then truly comes from your supplier's own account and passes every check your email provider makes, so the sentence “but it came from the right address” proves nothing. It is the most expensive misunderstanding in small-business finance.

The habit that catches it is dull and cheap, and it begins with a rule that no bank account changes because an email asked. One person requests the change and a second confirms it by phone, on the number already saved for that supplier. Only then does the payment go out. Two people and one call is all it takes, which is why Linkysoft asks a new client whether that rule exists before anything technical. Firms that lose six figures nearly always had one tired person doing both jobs late in the month.

The rule belongs inside the software rather than in a policy nobody reads. So when Linkysoft builds a finance screen inside a business web application, a changed bank account freezes that supplier until a second named user approves it. The old details stay on screen beside the new ones, and the system keeps who changed what and when, which is the first thing your bank will ask you for.

If it has already happened, speed matters more than blame, so call your bank within the hour and ask for a recall. Warn the supplier straight after, because their mailbox is the open one and their other customers are next. A security review afterwards is worth the money, but how much of the cash comes back depends on that first phone call.